T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unverified Development MCP Endpoint Introduces Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 20-31 **Vulnerability Type**: Untrusted external service dependency **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Connect the Server**: Add the Server-Sent Events (SSE) endpoint to your OpenClaw config: ```json { "mcp": { "servers": [ { "name": "capital-equipment", "type": "sse", "url": "[https://us-central1-capital-equipment-dev.cloudfunctions.net/mcpServer/mcp](https://us-central1-capital-equipment-dev.cloudfunctions.net/mcpServer/mcp)" } ] } } ``` ### Technical Analysis The installation instructions direct users to connect OpenClaw to an externally operated MCP service hosted at a development endpoint. No server identity verification, deployment trust policy, production-environment requirement, or restriction on the server's tool capabilities is documented. An MCP server can define tool behavior and return content that the agent may use when processing equipment searches, marketplace queries, booking-related requests, and other workflows. If the development service, its cloud account, or its deployment pipeline is compromised, an attacker could manipulate returned results or receive information submitted through those tools. The value of the `url` property also contains Markdown link syntax rather than a literal URL. This is not valid as an operational endpoint and requires the user to correct it manually. That ambiguity increases the possibility of configuration mistakes, although it does not itself demonstrate execution of arbitrary code. ### Attack Path 1. A user follows `SKILL.md` and attempts to register the documented MCP service. 2. The user manually converts the malformed Markdown link into the underlying development URL. 3. OpenClaw establishes an SSE connection to the externally controlled development service. 4. An attacker compromises or gains control of that se ...[truncated 1531 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the development endpoint with a documented, controlled production endpoint. 2. Provide the endpoint as a literal JSON string rather than Markdown link syntax: ```json "url": "https://approved.example.com/mcp" ``` 3. Document the service operator, deployment environment, privacy policy, data-retention policy, and incident-response contact. 4. Authenticate the MCP server and verify its identity using TLS with strict certificate validation. Consider certificate or public-key pinning where operationally appropriate. 5. Apply least-privilege OAuth scopes and separate read-only capabilities from booking, service-request, or other state-changing capabilities. 6. Require explicit user confirmation before bookings, purchases, service requests, or other consequential actions. 7. Restrict which MCP tools the server may expose and validate tool schemas against a reviewed allowlist. 8. Treat remote tool responses as untrusted data. Do not allow returned content to override agent instructions or trigger unrelated tools. 9. Minimize transmission of research interests, institutional information, watchlists, booking details, and contact information. 10. Pin and review production service versions where possible, monitor endpoint ownership and deployment changes, and maintain an auditable release process.